How To: Remove Kernel Extensions from macOS

Verified Product Versions

Issue:

Kernel extensions are present that need to be removed for testing deployment via Ivanti MDM.

Determine the extension is present:

From the target Mac, launch a terminal session and switch to an elevated shell session using the following command.

sudo sh

Then access the KextPolicy database using the following command.

sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy

Once in the SQLITE prompt, type the following command to list the installed kernel extensions:

select * from kext_policy;

The output will look similar to this:

Reboot into Recovery Mode:

While logged into macOS, the kext_policy DB is locked in Read Only mode, so the Mac will need to be rebooted into recovery mode. This can be done by following the steps in this Apple article. About macOS Recovery - Apple Support

Once recovery Mode has loaded, click Utilities, and select Terminal.

When in Recovery Mode, the SQLITE3 command cannot be launched from the current location. Instead, to connect to the database run the following commands: